I'm working on a system to backup logs.

I need to copy logs in an other path in order to backup. I found inotify (that i do absolutely not know) that should help me on this task but i'm not sure... I know that it is possible to work on a directory but here is what i would like to do:

When a file has been modified in a certain folder, copy that file in an other folder.

It is probably a basic thing to do but i did not find anything clear to me... If you have any idea...

  • Are these logs being updated constantly? If so, you're going to be copying entire files every time a new line is added to the end of the files you're watching. And how are you going to detect changes that need to be copied if they happen when your notification system isn't running? This is not an easy problem to solve, and something like inotify isn't going to get you a complete, reliable solution. Dec 4, 2017 at 13:26
  • Well, the logs are rotate every day and the machines are just hosting a little web page so the logs won't be very heavy... and the moment where the logs are changing very fast are only on boot sequence... My idea is to use inotify because i can't reconfigure rsyslog... i wan't to write in an µSD card... so i need to do it only whan the µSD is present on the system...
    – Jelek21
    Dec 4, 2017 at 14:13

2 Answers 2


For duplicating logs across multiple machines, a better approach may be to just configure rsyslog to deposit multiple copies of logs.


If you only require logs to clone each day, add a hook into your /etc/logrotate.d/* files (which ever you'd like to clone), so each time logs are rotated you do a rsync of logs from one machine to others.

If you use inotify() (likely via inotifywait or lsyncd), then you may end up in a situation where your machine is constantly thrashing (slowing down) trying to process rapid log changes into copies to other machines.

If you go the inotify() route, make sure you only do this with low volume logs (infrequent logging/changes). If you accidentally glom onto a log like syslog or Apache on a high traffic machine, you may take your machine down.

  • I did not find the way to do it by configurint rsyslog because the idea is to have logs on µSD card when it is present... The logs will be rotate everyday and the machines are not logging a lot... but they don't have any screen or anything so when they are not working properly, if the SSH is down i can't see what's going on and the only solution i have is to reflash a complete system... that's why i found the inotify way...
    – Jelek21
    Dec 4, 2017 at 14:16

Have rsync update with a cron job, (by the minute,hourly,daily, etc..) locally and/or remotely to another system. Rsync is very nice for backups, and their are many robust options.

  • oops just saw the comment above mine! Going to get some sleep now...
    – JaInI
    Dec 6, 2017 at 4:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .